Shaving parallel authenticator yak to remove unnecessary dependency on this class from OAuth spec...

chrome/browser/chromeos/cros/cryptohome_library.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/cryptohome_library.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/hash_tables.h"
 #include "base/message_loop.h"
+#include "base/string_number_conversions.h"
+#include "base/string_util.h"
 #include "chrome/browser/chromeos/cros/cros_library.h"
 #include "chrome/common/chrome_switches.h"
 #include "content/public/browser/browser_thread.h"
+#include "crypto/encryptor.h"
+#include "crypto/sha2.h"
 
 using content::BrowserThread;
 
 namespace {
-  const char kStubSystemSalt[] = "stub_system_salt";
+
+const char kStubSystemSalt[] = "stub_system_salt";
+const int kPassHashLen = 32;
+const size_t kKeySize = 16;
+
+// Decrypts (AES) hex encoded encrypted token given |key| and |salt|.
+std::string DecryptTokenWithKey(

[Nikita (slow), 2011/12/01 14:34:13]

DecryptTokenWithKey() should be moved to some common place to avoid code
duplication between CertLibrary and CryptohomeLibrary.

[zel, 2011/12/02 02:35:23]

CryptohomeLibrary does not need to have this one. It's removed from there now.

+    crypto::SymmetricKey* key,
+    const std::string& salt,
+    const std::string& encrypted_token_hex) {
+  std::vector<uint8> encrypted_token_bytes;
+  if (!base::HexStringToBytes(encrypted_token_hex, &encrypted_token_bytes))
+    return std::string();
+
+  std::string encrypted_token(
+      reinterpret_cast<char*>(encrypted_token_bytes.data()),
+      encrypted_token_bytes.size());
+  crypto::Encryptor encryptor;
+  if (!encryptor.Init(key, crypto::Encryptor::CTR, std::string()))
+    return std::string();
+
+  std::string nonce = salt.substr(0, kKeySize);
+  std::string token;
+  CHECK(encryptor.SetCounter(nonce));
+  if (!encryptor.Decrypt(encrypted_token, &token))
+    return std::string();
+  return token;
+}
+
 }
 
 namespace chromeos {
 
 // This class handles the interaction with the ChromeOS cryptohome library APIs.
 class CryptohomeLibraryImpl : public CryptohomeLibrary {
  public:
   CryptohomeLibraryImpl() {}
   virtual ~CryptohomeLibraryImpl() {}
 
@@ skipping 48 matching lines @@
     return CacheCallback(
         chromeos::CryptohomeAsyncRemove(user_email.c_str()),
         d,
         "Couldn't initiate async removal of cryptohome.");
   }
 
   virtual bool IsMounted() OVERRIDE {
     return chromeos::CryptohomeIsMounted();
   }
 
-  virtual CryptohomeBlob GetSystemSalt() OVERRIDE {
-    CryptohomeBlob system_salt;
-    char* salt_buf;
-    int salt_len;
-    bool result = chromeos::CryptohomeGetSystemSaltSafe(&salt_buf, &salt_len);
-    if (result) {
-      system_salt.resize(salt_len);
-      if ((int)system_salt.size() == salt_len) {
-        memcpy(&system_salt[0], static_cast<const void*>(salt_buf),
-               salt_len);
-      } else {
-        system_salt.clear();
-      }
-    }
-    return system_salt;
-  }
-
   virtual bool AsyncSetOwnerUser(
       const std::string& username, Delegate* d) OVERRIDE {
     return CacheCallback(
         chromeos::CryptohomeAsyncSetOwnerUser(username.c_str()),
         d,
         "Couldn't do set owner user in Cryptohomed.");
   }
 
   virtual bool TpmIsReady() OVERRIDE {
     return chromeos::CryptohomeTpmIsReady();
@@ skipping 63 matching lines @@
 
   virtual void Pkcs11GetTpmTokenInfo(
       std::string* label, std::string* user_pin) OVERRIDE {
     chromeos::CryptohomePkcs11GetTpmTokenInfo(label, user_pin);
   }
 
   virtual bool Pkcs11IsTpmTokenReady() OVERRIDE {
     return chromeos::CryptohomePkcs11IsTpmTokenReady();
   }
 
+  virtual std::string HashPassword(const std::string& password) OVERRIDE {
+    // Get salt, ascii encode, update sha with that, then update with ascii
+    // of password, then end.
+    std::string ascii_salt = GetSystemSalt();
+    char passhash_buf[kPassHashLen];
+
+    // Hash salt and password
+    crypto::SHA256HashString(ascii_salt + password,
+                             &passhash_buf, sizeof(passhash_buf));
+
+    return StringToLowerASCII(base::HexEncode(
+        reinterpret_cast<const void*>(passhash_buf),
+        sizeof(passhash_buf) / 2));
+  }
+
+  virtual std::string GetSystemSalt() OVERRIDE {
+    LoadSystemSalt();  // no-op if it's already loaded.
+    return StringToLowerASCII(base::HexEncode(
+        reinterpret_cast<const void*>(system_salt_.data()),
+        system_salt_.size()));
+  }
+
  private:
+  typedef base::hash_map<int, Delegate*> CallbackMap;
+
   static void Handler(const chromeos::CryptohomeAsyncCallStatus& event,
                       void* cryptohome_library) {
     CryptohomeLibraryImpl* library =
         reinterpret_cast<CryptohomeLibraryImpl*>(cryptohome_library);
     library->Dispatch(event);
   }
 
   void Dispatch(const chromeos::CryptohomeAsyncCallStatus& event) {
     const CallbackMap::iterator callback = callback_map_.find(event.async_id);
     if (callback == callback_map_.end()) {
       LOG(ERROR) << "Received signal for unknown async_id " << event.async_id;
       return;
     }
     if (callback->second)
       callback->second->OnComplete(event.return_status, event.return_code);
     callback_map_.erase(callback);
   }
 
   bool CacheCallback(int async_id, Delegate* d, const char* error) {
     if (async_id == 0) {
       LOG(ERROR) << error;
       return false;
     }
     VLOG(1) << "Adding handler for " << async_id;
     callback_map_[async_id] = d;
     return true;
   }
 
-  typedef base::hash_map<int, Delegate*> CallbackMap;
+  void LoadSystemSalt() {
+    if (!system_salt_.empty())
+      return;
+
+    char* salt_buf;
+    int salt_len;
+    bool result = chromeos::CryptohomeGetSystemSaltSafe(&salt_buf, &salt_len);
+    if (result) {
+      system_salt_.resize(salt_len);
+      if (static_cast<int>(system_salt_.size()) == salt_len)
+        memcpy(&system_salt_[0], static_cast<const void*>(salt_buf), salt_len);
+      else
+        system_salt_.clear();
+    }
+    CHECK(!system_salt_.empty());
+    CHECK_EQ(system_salt_.size() % 2, 0U);
+  }
+
+  chromeos::CryptohomeBlob system_salt_;
   mutable CallbackMap callback_map_;
 
   void* cryptohome_connection_;
 
   DISALLOW_COPY_AND_ASSIGN(CryptohomeLibraryImpl);
 };
 
 class CryptohomeLibraryStubImpl : public CryptohomeLibrary {
  public:
   CryptohomeLibraryStubImpl()
@@ skipping 43 matching lines @@
     BrowserThread::PostTask(
         BrowserThread::UI, FROM_HERE,
         base::Bind(&DoStubCallback, callback));
     return true;
   }
 
   virtual bool IsMounted() OVERRIDE {
     return true;
   }
 
-  virtual CryptohomeBlob GetSystemSalt() OVERRIDE {
-    CryptohomeBlob salt = CryptohomeBlob();
-    for (size_t i = 0; i < strlen(kStubSystemSalt); i++)
-      salt.push_back(static_cast<unsigned char>(kStubSystemSalt[i]));
-
-    return salt;
-  }
-
   virtual bool AsyncSetOwnerUser(
       const std::string& username, Delegate* callback) OVERRIDE {
     BrowserThread::PostTask(
         BrowserThread::UI, FROM_HERE,
         base::Bind(&DoStubCallback, callback));
     return true;
   }
 
   // Tpm begin ready after 20-th call.
   virtual bool TpmIsReady() OVERRIDE {
@@ skipping 55 matching lines @@
   }
 
   virtual void Pkcs11GetTpmTokenInfo(std::string* label,
                              std::string* user_pin) OVERRIDE {
     *label = "Stub TPM Token";
     *user_pin = "012345";
   }
 
   virtual bool Pkcs11IsTpmTokenReady() OVERRIDE { return true; }
 
+  virtual std::string HashPassword(const std::string& password) OVERRIDE {
+    return StringToLowerASCII(base::HexEncode(
+            reinterpret_cast<const void*>(password.data()),
+            password.length()));
+  }
+
+  virtual std::string GetSystemSalt() OVERRIDE {
+    return kStubSystemSalt;
+  }
+
  private:
   static void DoStubCallback(Delegate* callback) {
     if (callback)
       callback->OnComplete(true, kCryptohomeMountErrorNone);
   }
 
   std::map<std::string, std::string> install_attrs_;
   bool locked_;
   DISALLOW_COPY_AND_ASSIGN(CryptohomeLibraryStubImpl);
 };
 
 CryptohomeLibrary::CryptohomeLibrary() {}
 CryptohomeLibrary::~CryptohomeLibrary() {}
 
 // static
 CryptohomeLibrary* CryptohomeLibrary::GetImpl(bool stub) {
   CryptohomeLibrary* impl;
   if (stub)
     impl = new CryptohomeLibraryStubImpl();
   else
     impl = new CryptohomeLibraryImpl();
   impl->Init();
   return impl;
 }
 
 } // namespace chromeos